From 032afe3937d0bde3f9b35d52002212f90faf5bc9 Mon Sep 17 00:00:00 2001
From: thattommyhall <thattommyhall@gmail.com>
Date: Wed, 19 Apr 2017 16:04:25 +0100
Subject: [PATCH] Move ingress/egress to aws_security_group_rule in rds

When I make an RDS instance, it kept saying it needed to change stuff.
This is also best practice from what I can tell (if users of the module
need to add rules to the SG also)
---
 rds/main.tf | 52 ++++++++++++++++++++++++++++++----------------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/rds/main.tf b/rds/main.tf
index 6b013150..7c7dff30 100644
--- a/rds/main.tf
+++ b/rds/main.tf
@@ -87,32 +87,40 @@ variable "subnet_ids" {
   type        = "list"
 }
 
-resource "aws_security_group" "main" {
-  name        = "${var.name}-rds"
-  description = "Allows traffic to RDS from other security groups"
-  vpc_id      = "${var.vpc_id}"
+resource "aws_security_group_rule" "main-ingress-cidrs" {
+  security_group_id = "${aws_security_group.main.id}"
+  type              = "ingress"
+  cidr_blocks       = ["${var.ingress_allow_cidr_blocks}"]
+  from_port         = "${var.port}"
+  to_port           = "${var.port}"
+  protocol          = "TCP"
+}
 
-  ingress {
-    from_port       = "${var.port}"
-    to_port         = "${var.port}"
-    protocol        = "TCP"
-    security_groups = ["${var.ingress_allow_security_groups}"]
-  }
+resource "aws_security_group_rule" "main-ingress-sgs" {
+  security_group_id        = "${aws_security_group.main.id}"
+  type                     = "ingress"
+  count                    = "${length(var.ingress_allow_security_groups)}"
+  source_security_group_id = "${element(var.ingress_allow_security_groups, count.index)}"
 
-  ingress {
-    from_port   = "${var.port}"
-    to_port     = "${var.port}"
-    protocol    = "TCP"
-    cidr_blocks = ["${var.ingress_allow_cidr_blocks}"]
-  }
+  from_port                = "${var.port}"
+  to_port                  = "${var.port}"
+  protocol                 = "TCP"
+}
 
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = -1
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+resource "aws_security_group_rule" "main-egress-all" {
+  security_group_id = "${aws_security_group.main.id}"
+  type              = "egress"
+  from_port         = 0
+  to_port           = 0
+  protocol          = -1
+  cidr_blocks       = ["0.0.0.0/0"]
+}
 
+
+resource "aws_security_group" "main" {
+  name        = "${var.name}-rds"
+  description = "Allows traffic to RDS from other security groups"
+  vpc_id      = "${var.vpc_id}"
   tags {
     Name = "RDS (${var.name})"
   }